LangGraph SQLite Store CVE-2025-8709

Exploitation requires that the application uses LangGraph's SQLite store (langgraph-checkpoint-sqlite 2.0.10) AND that an attacker can control the value passed to one of the filter operators $eq, $ne, $gt, $lt, $gte, or $lte, since those values are concatenated into SQL without parameterization. Limiting factors: the CVSS vector indicates local attack vector (AV:L) and low-but-nonzero privileges (PR:L), so the attacker needs some level of access to the application or host rather than purely anonymous remote reach; no user interaction is required (UI:N). Real-world risk is therefore gated on whether the deploying application exposes filter inputs to untrusted users and whether it has migrated off the vulnerable 2.0.10 release.

Signals point to a moderate, context-dependent risk rather than a top-tier emergency. The provided CVSS 3.0 vector (AV:L/AC:L/PR:L/UI:N/S:C, 7.3 HIGH) describes a locally-reachable, low-complexity, low-privilege flaw with a scope change and high confidentiality impact - consistent with a SQL injection in an embedded SQLite store that lets one authenticated/low-privilege actor read data belonging to others. There is tension worth flagging: SQL injection is often thought of as network-reachable, but the vector specifies AV:L (local) because the SQLite store is an in-process/on-host component; whether a real deployment exposes the vulnerable filter input over a network depends entirely on how the host application wires user input into store queries - verify against the actual deployment. No EPSS score, no CISA KEV listing, and no confirmed public exploit were supplied; exploitation status is therefore 'no public exploit identified at time of analysis' (the huntr bounty report confirms the bug, not that weaponized code is circulating). SSVC-style read: technical impact is partial-to-total for confidentiality within the data store, exploitation is not observed, and automatability is uncertain because it hinges on whether filter values are attacker-controllable. Net: a genuine data-exposure bug worth patching promptly for anyone running langgraph-checkpoint-sqlite 2.0.10 with untrusted filter input, but not a drop-everything internet-wide threat on current evidence.

In a LangGraph application that uses the SQLite store and lets users influence document filters, a low-privileged user supplies a crafted value for a filter operator such as $eq or $gt. Because the operator value is concatenated directly into the SQL string instead of being parameterized, the injected clause bypasses the application's security/tenant filters and returns documents belonging to other users, including sensitive fields like stored passwords and API keys. No public exploit code was identified, but the bug class (CWE-89) and the named operators make a working payload straightforward to construct.